Hide Forgot
Description of problem: SSSD always attempts to use the START_TLS function when performing LDAP auth. However, some LDAP servers (especially those sitting behind SSL accelerators) cannot handle TLS over LDAPS. This prevents authentication from succeeding on those platforms. Version-Release number of selected component (if applicable): sssd-1.2.1-28.el6_0.4 How reproducible: Proof that this is happening is easily seen in the debug logs, however the auth failure requires a fairly complicated configuration. Steps to Reproduce: 1. Configure SSSD with ldap_uri = ldaps://ldap.example.com and auth_provider = ldap 2. Set DEBUG logs to level 4 or higher (debug_level = 4) 3. Perform an LDAP user login through SSSD. Actual results: Logs include a line like: (Fri Feb 11 14:27:08 2011) [sssd[be[default]]] [sdap_connect_send] (4): Executing START TLS Expected results: SSSD should not attempt to start TLS. Additional info: Extensive mailing list thread on sssd-devel: https://fedorahosted.org/pipermail/sssd-devel/2011-February/005651.html
No more "Executing START TLS" message logged in the domain logs while authenticating against ldaps. Snippet from /var/log/sssd/sssd_default.log: (Wed Apr 6 16:40:17 2011) [sssd[be[default]]] [auth_resolve_done] (8): [ldaps://sssdldap.redhat.com:636] is a secure channel. No need to run START_TLS Verified. # rpm -qi sssd | head Name : sssd Relocations: (not relocatable) Version : 1.5.1 Vendor: Red Hat, Inc. Release : 24.el6 Build Date: Sat 02 Apr 2011 01:24:54 AM IST Install Date: Tue 05 Apr 2011 11:11:29 AM IST Build Host: x86-012.build.bos.redhat.com Group : Applications/System Source RPM: sssd-1.5.1-24.el6.src.rpm Size : 3462740 License: GPLv3+ Signature : (none) Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla> URL : http://fedorahosted.org/sssd/ Summary : System Security Services Daemon
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2011-0560.html